CVE-2026-19026

CVE-2026-19026 is a NULL dereference in HDF5's N-Bit filter (H5Z__filter_nbit). The filter expects cd_values to contain at least 5 elements — it reads indices 0 through 4 for header fields — but performs no bounds validation before dereferencing. If cd_nelmts is less than 5, or if cd_values is NULL, the code crashes immediately. This matters more than a typical filter bug because of how it's triggered. Opening a file with h5ls to list its contents is enough — users don't need to explicitly invoke the N-Bit filter, only probe the file's structure. An attacker can distribute a malicious HDF5 file that crashes any tool or application that inspects it, including automated data processing pipelines that call h5ls or h5dump on untrusted input. The underlying issue is structural: HDF5's filter pipeline passes client data (cd_values) as opaque blobs with no library-level validation. The filter dispatch path performs no bounds or NULL checks — each filter implementation is solely responsible for guarding its inputs. H5Z__filter_nbit failed to do so. This pattern likely exists in other HDF5 filters. Until the filter dispatch path gains centralized input validation, similar vulnerabilities will emerge in other filters. What to do: treat any HDF5 file from untrusted sources as potentially malicious. Validate and sanitize file inputs before passing them to any HDF5 utility. Monitor for similar issues in other filters (shuffle, Fletcher, SZIP) if they haven't been reviewed. The patch for this specific instance will likely be a localized NULL check and bounds guard inside H5Z__filter_nbit — understand that this fixes the symptom, not the architecture.

Reviewed through automated stages and approved by a human before publication.